Archived
44 lines
1.6 KiB
Python
44 lines
1.6 KiB
Python
from karldns.security import (
|
|
DashboardUnlockIdentity,
|
|
_dashboard_unlock_cookie_parts,
|
|
_strip_header_ip,
|
|
_trusted_proxy_candidate,
|
|
)
|
|
|
|
|
|
def test_dashboard_unlock_identity_payload_is_stable() -> None:
|
|
identity = DashboardUnlockIdentity("home.example.net", "manage-secret", "hash")
|
|
|
|
assert identity.payload(123, 3600) == b"home.example.net\x00manage-secret\x00hash\x00123\x003600"
|
|
|
|
|
|
def test_trusted_proxy_candidate_matches_cidr_and_single_ip() -> None:
|
|
assert _trusted_proxy_candidate("10.10.0.1", "10.0.0.0/8") is True
|
|
assert _trusted_proxy_candidate("203.0.113.10", "203.0.113.10") is True
|
|
|
|
|
|
def test_trusted_proxy_candidate_ignores_invalid_values() -> None:
|
|
assert _trusted_proxy_candidate("not-an-ip", "10.0.0.0/8") is False
|
|
assert _trusted_proxy_candidate("10.10.0.1", "not-a-network") is False
|
|
|
|
|
|
def test_dashboard_unlock_cookie_parts_parse_v3_cookie() -> None:
|
|
parts = _dashboard_unlock_cookie_parts("v3:123:3600:signature")
|
|
|
|
assert parts is not None
|
|
assert parts.timestamp == 123
|
|
assert parts.max_age_seconds == 3600
|
|
assert parts.signature == "signature"
|
|
|
|
|
|
def test_dashboard_unlock_cookie_parts_reject_invalid_cookie() -> None:
|
|
assert _dashboard_unlock_cookie_parts("v2:123:3600:signature") is None
|
|
assert _dashboard_unlock_cookie_parts("v3:not-int:3600:signature") is None
|
|
|
|
|
|
def test_strip_header_ip_handles_common_proxy_formats() -> None:
|
|
assert _strip_header_ip('"203.0.113.10"') == "203.0.113.10"
|
|
assert _strip_header_ip("[2001:db8::10]:443") == "2001:db8::10"
|
|
assert _strip_header_ip("203.0.113.10:443") == "203.0.113.10"
|
|
assert _strip_header_ip("unknown") == ""
|